반품
-
제목
AD account usage for SSH session adds domain to account -
설명
Using AD domain account for connection to SSH target (Cisco).
SPP always adds the domain account name (sAMAccountName).
Alternate login name is UPN so that is also with domain.
That is the reason that connection to those targets don't work in SPP at all.
-
원인
Name attribute has the same information as sAMAccountName. -
해결 방안
*Note - you need to set Use Alternate Login Name in the Access Request Policy
Name attribute has the same information as sAMAccountName.
If that does not work, then populate another field with the information that is wanted and use that instead.
It's possible to use the Alternate Login Name setting in the AD Asset Attributes tab to set that value to something other than the UPN. Notice that the cn value is the same as the sAMAccountName (that is, just the userid, and not the userid@somedomain.com.)
-
추가 정보
Name attribute can be the same if there is a blank space in the account itself (when the account has First name and Last Name). Normally this should be the case in the service accounts. User account very often has first and last name and then there is a blank space in between the name attribute. There does not seem to be an attribute that is always exactly the same as the sAMAccountName. Choosing the “Display Name” to be the attribute to use. Reason is, that it is easy to see in AD, because it is in view in User Properties General tab. This field can be different, and can be risky.